🔐 pwned-check

"Have you been pwned? Let's find out. Anonymously."

A slick Node.js CLI that checks your passwords against billions of leaked credentials — without ever sending your actual password anywhere. Built on the HaveIBeenPwned API with k-anonymity baked in.

---

⚡ Quick Start

git clone https://github.com/blackadi/pwned-check.git
cd pwned-check
npm install
node index.js

That's it. You're in.

---

🕵️ How It Works

Your password never leaves your machine. Here's the sneaky math:

password  →  SHA-1 hash  →  split into [first5] + [tail]
                                              │
                              sent to API ───┘   (only the first 5 chars)

API returns all hashes starting with those 5 chars (~500 matches)
You check locally if your tail is in the list.

The server never sees enough to reconstruct your password. That's k-anonymity — the API literally cannot tell what you typed. 🧠

---

🚀 Usage

Interactive mode (recommended)

Just run it. No args. It'll ask you everything.

node index.js

  🔐 Password Leak Checker
  Powered by HaveIBeenPwned · k-anonymity protected

  ? Enter a password to check: ••••••••
  ⠴ Checking against breach database…

  ✖ [your password] — leaked 7,895,465 times
    Change this password immediately!

  ? Check another password? (y/N)

---

Inline args (quick and scriptable)

node index.js hunter2 correct-horse-battery-staple

Check multiple passwords in one shot. Results print one by one with a spinner for each.

---

Batch mode (for the paranoid)

Have a whole list? Drop them in a .txt file, one per line:

node index.js --batch passwords.txt

Great for auditing a dump of old credentials you've been meaning to rotate. No judgment.

---

JSON output (for CI pipelines & scripts)

node index.js --json hunter2

{ "password": "hunter2", "leaked": true, "count": 14438680 }

Pipe it into jq, ship it to a webhook, fail your CI build if anything leaks — go wild.

---

🎛️ All Flags

Flag	Short	What it does
--batch <file>	-b	Check every password in a text file
--json	-j	Output results as JSON
--quiet	-q	No colors, no decorations — raw results only
--debug		Show SHA-1 prefix + tail (for the curious)
--version		Print version and exit
--help		You already know

---

🧰 Stack

Package	Why
chalk	Terminal colors — red = bad, green = good
ora	Spinner so you know it's thinking
inquirer	Masked password prompts (no shell history leaks)
commander	CLI flags and argument parsing
node:crypto	SHA-1 hashing — built into Node, zero deps
fetch	HTTP — also built into Node 18+, zero deps

Node 18+ required. No legacy nonsense.

---

🔒 Security Notes

• ✅ Your password is hashed locally before anything hits the network
• ✅ Only the first 5 characters of the SHA-1 hash are sent to the API
• ✅ Interactive mode uses masked input — your password won't appear in terminal output or shell history
• ✅ Passing passwords as CLI args still works but be aware they may appear in ps output or your shell's history file — use interactive mode when in doubt
• ✅ No logging, no analytics, no storage — this tool is stateless by design

---

💡 Pro Tips

Audit your password manager export:

# Export your passwords to a plain list, then:
node index.js --batch export.txt --json | jq 'select(.leaked == true)'

Fail a CI build if a secret leaks:

node index.js --json --quiet "$MY_SECRET" | jq -e '.leaked == false'

Curious about the raw hashing?

node index.js --debug yourpassword
# [debug] prefix=5BAA6  tail=1BE14AF48...

---

📄 License

MIT — do whatever you want with it.

---

Built with paranoia and good taste. 🖤